Authentication bypass in the Authora : Easy login with mobile number WordPress plugin (all versions before 1.7.7) exposes one-time login codes and valid verification tokens directly in the HTTP response of an unauthenticated endpoint, completely nullifying the mobile-based OTC authentication mechanism. Any unauthenticated attacker who knows a registered user's mobile number - including an administrator's - can obtain a valid session token without receiving an SMS, achieving full account takeover. A publicly available proof-of-concept exploit exists via WPScan; EPSS sits at 0.14% (4th percentile), indicating limited observed exploitation despite POC availability and no CISA KEV listing.
Unauthenticated forged conversion event injection in Pixel Tag Manager for WooCommerce (all versions before 2.2.1) allows any remote attacker to submit fabricated e-commerce conversion events to the site's server-side advertising APIs - such as Meta Conversions API or Google Ads - using the site's own stored credentials. The root cause is a missing authorization check on a WordPress AJAX action (CWE-284), meaning the endpoint processes requests from anyone without verifying identity or role. A publicly available exploit exists per WPScan; however, the EPSS score of 0.14% (4th percentile) indicates opportunistic exploitation has not yet been observed at scale.
Missing authorization controls in the Buckaroo WooCommerce Payments Plugin before 4.9.0 allow any authenticated WordPress user - including low-privilege Subscribers - to trigger payment capture refunds against any captured order via an unprotected AJAX endpoint. The flaw causes direct financial integrity loss for merchants, as unauthorized refund processing reverses captured payments without any approval workflow. A publicly available exploit exists per WPScan, though EPSS remains very low at 0.13% (3rd percentile), indicating exploitation has not become widespread despite the accessible attack surface.
Stored cross-site scripting in the Download Manager WordPress plugin before 3.3.66 allows any authenticated user with the Author role or above to inject a malicious JavaScript payload into a download package title, which then executes in the browser of every visitor - including unauthenticated users - who views any page rendering that package. A publicly available proof-of-concept exists, though the EPSS score of 0.19% (9th percentile) and absence of a CISA KEV listing suggest exploitation remains limited and targeted rather than widespread. Vendor-released patch version 3.3.66 is available.
Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user to inject persistent JavaScript into a profile field that executes in any visitor's browser - including logged-in administrators - upon viewing the attacker's public participant profile page. A publicly available proof-of-concept exploit exists, and the CVSS scope change (S:C) reflects that the injected script runs in victim browser contexts entirely outside the plugin's security boundary, enabling credential theft or admin-level site takeover. EPSS is low (0.15%, 5th percentile), suggesting mass exploitation has not yet materialized despite the public POC.
Stored cross-site scripting in the Codeless Page Builder WordPress plugin (versions through 1.1.4) allows contributor-level users to inject arbitrary HTML and JavaScript by supplying unsanitized input as an HTML tag name via a shortcode attribute. When a higher-privileged user such as an administrator views the crafted content, the payload executes in their browser session, enabling session hijacking or unauthorized administrative actions. A public exploit proof-of-concept is available via WPScan; exploitation probability is low per EPSS (0.15%, 5th percentile), suggesting opportunistic rather than widespread active targeting.
Stored cross-site scripting in Admin Columns for ACF Fields WordPress plugin (through 0.3.2) allows contributor-level users to inject unsanitized JavaScript via Advanced Custom Fields values that execute in the browser session of any higher-privileged user who views the affected post-list admin screen. The scope change (S:C in CVSS) reflects that the payload crosses privilege boundaries - a low-privileged contributor can target editors and administrators. A publicly available exploit has been published by WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation in the wild, and this CVE is not listed in the CISA KEV catalog.
Directory traversal in Support Genix WordPress plugin before 1.4.48 exposes arbitrary server files to unauthenticated remote attackers via the ticket-attachment download route. Exploitation is constrained to files matching an allowlisted extension set, yet this still enables disclosure of other users' private ticket attachments and any other allowlisted-extension files accessible to the web server process. A publicly available proof-of-concept exists per WPScan, though EPSS sits at only 0.25% (17th percentile), indicating low observed exploitation pressure despite the low attack complexity.
Unauthenticated order manipulation in the Direct Payments for WooCommerce WordPress plugin before 2.5.3 enables any remote attacker to forge payment completion states, overwrite payment-method labels, and attach fabricated proof-of-payment files to arbitrary customer orders. The flaw stems from multiple AJAX handlers that process order updates without verifying the requester owns or is otherwise authorized to modify the targeted order. A publicly available proof-of-concept exists and the SSVC framework rates this as automatable, meaningfully amplifying the fraud risk for affected merchants despite the EPSS score of 0.15% (4th percentile).
Vote-limit bypass in YOP Poll WordPress plugin before 7.0.6 allows unauthenticated remote attackers to cast unlimited votes on any public poll by spoofing IP addresses through client-controlled HTTP forwarding headers. The plugin enforces its per-IP vote restriction by reading attacker-supplied headers such as X-Forwarded-For rather than the validated TCP connection IP, making the restriction trivially circumventable. A publicly available proof-of-concept exists per WPScan reporting; EPSS sits at 0.14% (4th percentile), indicating low broad exploitation activity at time of analysis despite the low attack complexity.
Unauthenticated order status manipulation is possible in the Event Tickets and Registration WordPress plugin across all versions before 5.29.0.1, due to a completely absent authorization check on an order-management REST endpoint. Any remote actor - with no credentials or privileges - can alter the status of existing orders, enabling fraud scenarios such as marking unpaid orders as completed. A publicly available exploit exists per WPScan; however, EPSS at 0.14% (4th percentile) indicates mass exploitation has not materialized at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated server-side request forgery in the Pixelavo WordPress plugin before 1.5.4 allows any visitor to inject arbitrary Facebook conversion events using the site administrator's stored Conversions API access token. The plugin registers an AJAX endpoint protected only by a nonce that is emitted in plaintext on every public page load, rendering the nonce trivially obtainable and the endpoint effectively unprotected. Attackers can poison the administrator's Facebook Ads analytics with fabricated conversion data and exhaust the configured API quota, degrading ad targeting and measurement. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to inject persistent JavaScript into a conversational-form display setting that then executes in the browser of any site visitor who views the affected form. The vulnerability is particularly relevant on WordPress multisite installations, where administrators do not hold the unfiltered_html capability and are therefore expected to be constrained to safe content - making this a bypass of that trust model. A public proof-of-concept exists per WPScan, though EPSS sits at 0.16% (6th percentile), suggesting negligible observed exploitation activity at time of analysis.
CSRF in Podlove Podcast Publisher WordPress plugin (all versions before 4.5.3) allows unauthenticated remote attackers to forge administrative requests that create rogue records or delete legitimate plugin data, provided a logged-in administrator can be socially engineered into visiting a malicious page. A publicly available proof-of-concept exists per WPScan and SSVC data, though EPSS sits at just 0.10% (1st percentile), indicating no significant opportunistic exploitation activity. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Denial of service in the axios HTTP client library allows remote attackers to crash server-side request paths by exploiting an incomplete depth-limit bypass introduced as a residual flaw after the prior fix for GHSA-62hf-57xw-28j9. Affected are npm axios versions 0.31.1 through 0.32.x and 1.15.1 through 1.17.x; server-side Node.js applications that accept user-controlled input and pass it to axios form or parameter serialization are the primary concern. No public exploit code has been identified and no CISA KEV listing exists, but the attack mechanism is fully documented in the vendor's GitHub security advisory, materially lowering the exploitation bar for motivated actors.
NO_PROXY bypass in axios Node.js HTTP client exposes local services to configured proxies when requests target 0.0.0.0. Affected versions 1.15.0-1.17.x and 0.31.0-0.32.x omit 0.0.0.0 from loopback address recognition in shouldBypassProxy.js, causing traffic intended to bypass proxy routing to instead be forwarded through HTTP_PROXY or HTTPS_PROXY. Plain HTTP requests are most exposed since the proxy receives the full request URL, headers, and body; HTTPS is partially mitigated by CONNECT tunneling. No public exploit or CISA KEV listing identified at time of analysis, but exploitation requires only attacker-controlled URL input in an otherwise common Node.js proxy deployment.
Denial of service in guzzlehttp/guzzle versions before 7.15.1 allows a malicious or compromised upstream server to exhaust memory and break outbound requests by returning unlimited, oversized Set-Cookie headers. Guzzle's built-in CookieJar imposes no cap on cookie count or field size, so attacker-controlled cookies accumulate in memory and are later copied into a single outbound Cookie header that exceeds limits in handlers, proxies, or destination servers. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the cross-subdomain cookie scope (e.g., attacker.example.com poisoning cookies for service.example.com) extends the potential blast radius beyond the initially contacted server.
Proxy-Authorization header leakage in guzzlehttp/guzzle before 7.14.2 allows origin servers to receive proxy credentials due to a cURL handler misclassification bug. When requests are routed via SOCKS proxies, match no_proxy bypass rules, connect directly with proxying disabled, or cross proxy boundaries during redirects, Guzzle fails to migrate the Proxy-Authorization header from cURL's origin header list to the proxy-only channel - the credential arrives at the origin server instead of being confined to the proxy hop. An attacker who controls or monitors a destination origin server can harvest these credentials from access logs, then abuse the proxy to impersonate the proxy principal or reach destinations gated behind that proxy. No public exploit code has been identified at time of analysis.
BEAM atom-table exhaustion in ueberauth Guardian 2.0.0-2.4.0 allows denial of service by crashing the entire Erlang/Elixir node and all co-hosted services. The Guardian.Permissions module's encode_permissions!/1 function, installed on every module that invokes 'use Guardian.Permissions', unconditionally calls String.to_atom/1 on every key of a caller-supplied map before any validation. Because the integer-value clause of do_encode_permissions!/2 short-circuits to encoding without validating keys against the configured permission set, an attacker who can supply a permissions map with novel keys - for example via a request body fed into token issuance - permanently consumes BEAM atom-table slots at a rate bounded only by available request throughput. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch (2.4.1) is available.
Guardian's AtomEncoding permission encoder (versions 2.0.0-2.4.1) crashes the BEAM runtime by converting attacker-supplied binary strings directly to permanent atoms via String.to_atom/1, completely bypassing the application's permission allow-list. The BEAM atom table is fixed at approximately 1,048,576 non-garbage-collected entries; exhausting it raises a system_limit error that terminates the entire Erlang node and every application co-hosted on it. This path is only reachable when AtomEncoding is explicitly opted into; no CISA KEV listing or public exploit exists, but the attack is trivially automatable against any network endpoint that routes external permission scope values through encode/3.
Unbounded atom creation in Guardian.Plug.Keys allows any attacker who can route arbitrary string values through Guardian's key derivation functions to permanently exhaust the BEAM virtual machine's atom table, crashing the entire BEAM node and denying service to every application co-hosted on it. All guardian releases from 0.1.0 through 2.4.0 are affected whenever an application passes attacker-influenced data - a tenant identifier, HTTP header, or similar request value - as the key parameter to Guardian.Plug.current_token/2, current_claims/2, current_resource/2, or directly to Guardian.Plug.Keys functions. No public exploit code has been identified at time of analysis, though the attack mechanism is mechanically trivial given that it requires only a stream of distinct HTTP requests to a single vulnerable endpoint.
Stored cross-site scripting in luci-app-https-dns-proxy allows a highly privileged but potentially lower-trust authenticated LuCI user to persist a malicious JavaScript payload via the resolver_url parameter, which then silently executes in any administrator's browser when the HTTPS DNS Proxy status page is loaded. All currently tracked LuCI versions appear affected per EUVD listing (luci 0 <*). No public exploit code or CISA KEV listing is confirmed at time of analysis, though the stored nature of this XSS makes it more dangerous than a reflected variant because no additional attacker interaction is needed after initial injection.
Local file inclusion in the GetPaid WordPress plugin (versions ≤ 2.8.56) enables authenticated administrators to include and execute arbitrary PHP files on the server by supplying a crafted element type value to the getpaid_payment_form_element function. The root cause (CWE-98) is twofold: the element type string was used unsanitized to construct a PHP template file path, and the bare extract($element) call without EXTR_SKIP allowed attacker-controlled array keys to overwrite internal variables including the path already resolved. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis; real-world risk is substantially constrained by the administrator-level access and PHP file upload prerequisites.
Sensitive information exposure in the Advanced Views WordPress plugin (wplakeorg, all versions ≤ 3.9.1) allows any authenticated subscriber-level user to harvest admin-authored editor content - including template markup, CSS, JavaScript, and PHP controller variables - via improperly authorized REST API routes. Wordfence identified the flaw across three CPT interactive field classes (base, Layout, and Post Selection). No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar of subscriber-level access makes this trivially exploitable on any WordPress site with open user registration.
SQL Injection in CubeWP Framework plugin for WordPress (all versions through 1.1.30) enables authenticated attackers holding only subscriber-level access to append arbitrary SQL to database queries via the cubewp_remove_relation() AJAX handler, exposing the full WordPress database to read-based attacks. The flaw is particularly egregious because the code actively undoes WordPress's built-in injection protection: wp_unslash() strips the magic-quotes escaping that WordPress applies to all POST data, then the unescaped relation_id is interpolated directly into a raw SQL query without wpdb->prepare(), with sanitize_text_field() providing no SQL protection whatsoever. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low subscriber-level authentication bar significantly elevates real-world risk on sites with open user registration.
Second-order SQL injection in the Icegram Engage WordPress plugin (all versions through 3.1.42) allows authenticated attackers holding sufficient WordPress role privileges to extract arbitrary data from the site database across two deliberate HTTP requests. A crafted `messages[][id]` value is first persisted to WordPress post meta through the `save_campaign_preview()` AJAX action, then later interpolated unescaped into a SQL `IN()` clause inside `get_message_data()` during a subsequent preview request - bypassing `$wpdb->prepare()` entirely. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported the issue with a CVSS 6.5 base score reflecting high confidentiality impact against an unchanged scope.
Bluetooth GATT notification and indication paths in Zephyr RTOS 2.6.0 through 4.4.x skip the application-configured encryption, authentication, and LESC security requirements for characteristic values when the application follows the documented idiom of passing the Characteristic Declaration attribute to the notify/indicate APIs. A remote Bluetooth peer within radio range can connect without pairing and trigger the server to emit protected characteristic values over an unsecured link by writing the Client Characteristic Configuration descriptor, achieving an access-control bypass and information disclosure. No public exploit is identified at time of analysis; exploitation requires adjacent network access and specific application configuration.
Stored Cross-Site Scripting in the GenerateBlocks WordPress plugin (all versions through 2.3.0) allows authenticated contributors to permanently inject malicious JavaScript into published pages by exploiting unsanitized dynamic tag rendering in non-URL HTML attributes. An attacker with contributor-level WordPress access can chain a dynamic tag placeholder (e.g., {{post_meta key:...}}) in an element attribute with a crafted post meta value containing attribute-breaking syntax, causing script execution in the browser of any subsequent visitor. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the detailed technical disclosure from Wordfence lowers the bar for independent exploitation.
Stored cross-site scripting in the Download Manager WordPress plugin (all versions through 3.3.66) allows authenticated contributors to inject persistent JavaScript payloads via the 'icon' shortcode attribute, which execute automatically in the browser of any user who visits an injected page. The flaw exploits a gap in WordPress's wp_kses_post() sanitization: it processes post content at save time but does not intercept shortcode attribute values that are echoed unescaped at render time, as confirmed by source code at UI.php#L81 and Shortcodes.php#L18. No public exploit code or CISA KEV listing is present at time of analysis, but the low privilege bar (contributor access) and automatic payload execution upon page view elevate practical risk on multi-author WordPress sites.
Stored Cross-Site Scripting in the Advanced Woo Labels - Product Labels & Badges for WooCommerce WordPress plugin (all versions through 2.48) allows authenticated contributors to permanently inject malicious JavaScript via the 'bg_color' parameter into product label definitions. Insufficient input sanitization across multiple rendering functions - confirmed at specific lines in class-awl-label-view.php, awl-functions.php, and class-awl-admin.php - means the payload persists in the database and executes in any visitor's browser on affected product pages. No active exploitation has been confirmed (not in CISA KEV), and no public POC has been identified; a fix was committed in WordPress SVN changeset 3627180.
Stored cross-site scripting in the Powerkit plugin for WordPress (all versions up to and including 3.1.0) allows authenticated attackers holding contributor-level access to inject persistent JavaScript payloads via the 'style' shortcode attribute, which execute silently in any visitor's browser upon viewing an injected page. The root cause is confirmed by Wordfence (security@wordfence.com) and traceable to missing output escaping in the plugin's basic-elements module across at least two code paths and one template file. No CISA KEV listing or public exploit code has been identified at the time of analysis, though the low privilege bar - contributor access - makes this a practical threat on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated contributors permanently embed malicious scripts into WordPress pages via the Identity Block's inner image content, with those scripts executing in the browsers of any subsequent visitor. The vulnerable code path inside build_html() is only reachable when the Identity Block's urlTransparent attribute is explicitly set to a non-empty value, narrowing exposure to sites where contributors actively configure this specific block attribute. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, though the CVSS Scope:Changed rating reflects that injected payloads execute in victim browser contexts rather than being confined to the server side.
Stored Cross-Site Scripting in the Powerkit - Supercharge Your WordPress Site plugin (versions up to and including 3.1.0) enables authenticated contributors to inject persistent malicious scripts via the 'nav' shortcode attribute that execute in any visitor's browser upon page load. Reported by Wordfence, the flaw originates in the tabs.php template and the public class handler where shortcode input is passed to output without sanitization or escaping. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS scope-changed vector (S:C) indicates cross-user impact with a 6.4 medium-high base score.
Stored Cross-Site Scripting in the SureForms WordPress plugin (all versions through 2.8.1) allows authenticated contributors to inject persistent JavaScript payloads via the unsanitized 'headingWrapper' parameter in the Advanced Heading Gutenberg block. Any user who subsequently visits a page containing the injected block triggers script execution in their browser, creating a realistic path to admin session hijacking when site administrators review contributor-submitted content. No public exploit code has been identified at time of analysis, and a patch is available in version 2.8.2.
Stored Cross-Site Scripting in the SendPulse Email Marketing Newsletter WordPress plugin (all versions through 2.2.5) allows authenticated contributors to inject persistent malicious scripts that execute against any visitor - including administrators - who views a page rendering the [sendpulse-form] shortcode. The attack exploits an allow-list bypass in the _sp_form_code Post Meta: by prepending a benign SendPulse loader script tag to an arbitrary payload (such as an img onerror handler), the sanitization check is circumvented and the script is stored and later reflected into victim browsers. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed bypass technique described in the disclosure lowers the bar for reproduction significantly.
Stored Cross-Site Scripting in the Powerkit plugin for WordPress (all versions through 3.1.0) allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via shortcode attributes in the basic-elements module. The injected payload persists server-side and executes in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS Scope:Changed rating and Wordfence disclosure reflect meaningful cross-user impact.
Stored Cross-Site Scripting in GamiPress WordPress plugin (versions through 7.9.9.1) enables contributor-level authenticated users to inject persistent JavaScript payloads via the 'gamipress_rank' shortcode, which then executes silently in any visitor's browser upon page load. The CVSS Scope Changed metric (S:C) reflects that injected scripts escape the plugin's component boundary and can compromise administrator sessions or site visitors. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin allows authenticated contributors to persist malicious JavaScript in pages, which executes silently in any visitor's browser. All plugin versions up to and including 2.2.11 are affected via the 'layoutCircle.alignment' block attribute in the progress-bar block, where attacker-controlled input is neither sanitized on entry nor escaped on output. Wordfence reported this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar is low on many WordPress sites.
Stored Cross-Site Scripting in the GamiPress WordPress plugin (all versions through 7.9.9.1) permits contributor-level authenticated users to inject persistent JavaScript payloads via the `heading_size` attribute of the `gamipress_achievement` shortcode. The root cause is a WordPress-specific sanitization gap: wp_kses_post strips disallowed HTML at save time but cannot neutralize payloads embedded inside shortcode attribute strings, which are only interpolated into HTML output at render time without escaping — meaning the injected script executes in any visitor's browser who loads the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of the payload and the low privilege bar make this a meaningful risk on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated contributors to inject persistent JavaScript payloads via the 'toggleIcon' block attribute, which execute in the browsers of any user who subsequently visits the poisoned page. The scope change (S:C in CVSS) means impact crosses from the plugin into victim browser sessions, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing is identified at time of analysis, but the low barrier to exploitation-contributor-level access is readily obtained on multi-author WordPress sites-elevates practical risk above the moderate CVSS score might suggest.
Stored Cross-Site Scripting in the Easy Property Listings WordPress plugin (all versions up to and including 3.5.24) allows any authenticated subscriber-level user to permanently inject malicious JavaScript through the 'facebook' User Contact Method profile field. The injected payload persists in the WordPress database and executes automatically in the browser of any site visitor who views a property listing page rendering the compromised author profile, enabling session hijacking, credential theft, or administrative account takeover. No KEV listing or confirmed public exploit code was identified in the available input data; a fix changeset exists in the WordPress plugin repository but an exact patched release version is not confirmed from the provided data.
Prototype-pollution read-side gadgets in axios versions >=1.15.2 and <1.18.0 allow an attacker who already controls a separate prototype-pollution primitive in the host application to inject attacker-chosen Basic auth credentials into outbound HTTP requests. When axios processes a request with an own auth object that omits the username or password properties, it falls through to read Object.prototype.username and Object.prototype.password, constructing a forged Authorization: Basic header. Exploiting this requires chaining with a pre-existing prototype pollution vulnerability - axios itself does not pollute prototypes - and no public exploit or CISA KEV listing exists at time of analysis. The vendor-released patch is axios 1.18.0.
The fetch adapter in axios 1.7.0 through 1.17.x silently skips the maxBodyLength enforcement when a WHATWG ReadableStream body has no determinable Content-Length, allowing attacker-supplied stream data to bypass configured upload size limits. Applications that proxy or relay untrusted stream data via axios with the fetch adapter and rely solely on maxBodyLength as the size guard are exposed to uncontrolled outbound egress and potential exhaustion of upstream API quotas or bandwidth. No public exploit has been identified at time of analysis; CVSS 4.0 scores this at 6.3 with limited availability impact (VA:L) and an attack prerequisite (AT:P) reflecting the specific conditions required.
HTTP/2 streamed upload requests in axios 1.13.0-1.17.x bypass the configured maxBodyLength limit, allowing applications that proxy attacker-controlled streams to an upstream HTTP/2 service to transmit outbound data of arbitrary size. The flaw is constrained to upload-forwarding architectures that explicitly configure a finite maxBodyLength, use the Node.js HTTP adapter with httpVersion: 2, and accept streamed request bodies - conditions common in reverse-proxy and file-upload relay patterns. Impact is limited to resource exhaustion and policy bypass (excess egress costs, upstream quota consumption, limited availability); no public exploit has been identified and the CVE is not listed in CISA KEV.
Uncontrolled recursion in axios's formDataToJSON helper allows remote, unauthenticated attackers to exhaust the JavaScript call stack and deny service to affected Node.js applications. axios versions 0.28.0 through 0.32.x and 1.0.0 through 1.17.x are affected wherever attacker-controlled FormData field names are deserialized with Content-Type: application/json, causing a RangeError that kills the request or terminates the process. No public exploit has been identified at time of analysis, but the GHSA advisory discloses sufficient technical detail - including the exact vulnerable function and the attack payload pattern - for independent reproduction; fixed releases 0.33.0 and 1.18.0 are available.
Uncontrolled recursion in axios's formDataToJSON helper (versions 0.28.0 through <0.33.0 and 1.0.0 through <1.18.0) allows unauthenticated remote attackers to exhaust the JavaScript call stack by submitting FormData with field names containing thousands of nested bracket segments. The vulnerable buildPath() function in lib/helpers/formDataToJSON.js recurses once per path segment with no depth limit, causing a RangeError that, in server-side Node.js applications lacking exception handling, can terminate the process. No active exploitation or public exploit code has been identified at time of analysis; two patched releases (0.33.0 and 1.18.0) are available.
Prototype pollution gadget in the axios npm HTTP client silently injects Authorization headers or tampers query-string serialization when Object.prototype has already been polluted by a separate component sharing the same JavaScript process. Affected versions 0.8.0-0.32.x and 1.0.0-1.17.x fail to apply own-property guards when cloning nested config objects such as auth and paramsSerializer, allowing inherited string values from a polluted prototype to surface as request credentials or serializer overrides. No public exploit has been identified at time of analysis, and exploitation is entirely conditional on chaining with a pre-existing prototype pollution vulnerability elsewhere in the application or its dependency tree.
Read-side prototype pollution gadgets in axios allow a secondary attacker primitive to corrupt HTTP request semantics when Object.prototype has already been polluted by a separate, pre-existing vulnerability in the same application. Affected are the bodyless method aliases - axios.get(), axios.delete(), axios.head(), and axios.options() - across all 1.x releases below 1.18.0 and all 0.x releases below 0.33.0. An attacker who controls Object.prototype pollution can inject a fabricated request body into what the application intends as a bodyless request, or, via lower-level adapter paths, route requests through an attacker-controlled proxy or invoke custom URL serialization logic. No public exploit identified at time of analysis and no CISA KEV listing, but the CVSS 4.0 AT:P metric explicitly models the required precondition attack.
Reflected XSS in the WP Responsive Thumbnail Slider WordPress plugin (all versions before 1.1.53) enables unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing the 'id' parameter. The vulnerable surface is the responsive_thumbnail_image_management() function, which echoes raw GET input into an HTML attribute without esc_attr() and whose only guard - a loose PHP numeric comparison - is trivially bypassed by any string prefixed with a digit. Exploitation requires social engineering a privileged WordPress user into clicking the crafted link; no public exploit or CISA KEV listing has been identified at time of analysis.
Reflected Cross-Site Scripting in the Fluent Forms WordPress plugin (versions up to and including 6.2.8) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in the 'param' parameter. The vulnerability originates from insufficient sanitization and output escaping in Component.php (lines 1452 and 1456), and exploitation requires social engineering - the attacker must trick a user into clicking a crafted URL. A patch was released in version 6.2.9, confirmed by the WordPress Trac changeset. No public exploit code or CISA KEV listing is identified at time of analysis.